CVE-2026-118104

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1181058.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-1181068.1Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.CVE-2026-1181087.5Improper authorization in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181098.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-118113.7The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor onCVE-2026-1181108.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-1181118.0Origin validation error in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181128.0Improper control of generation of code ('code injection') in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181138.0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-1181147.5Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-1181157.5Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate CVE-2026-1181167.0Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate
CVE-2026-118104: Medium severity, CVSS 6.5 | Vulnix